---
title: "POST /v1/invites/{token}/accept"
method: POST
path: "/v1/invites/{token}/accept"
---

# POST /v1/invites/{token}/accept

`POST /v1/invites/{token}/accept`

## Request

- The document declares no server URL.
- Auth: one of:
  - HTTP bearer
  - API key in cookie `__Secure-better-auth.session_token`

Accept an invitation. The caller must be signed in as the invited address.

## Path parameters

- `token` string, required

## Response `201`

The request has succeeded and a new resource has been created as a result.

- Member
  - `userId` string, required
  - `name` string, required: What the organisation calls this person. ⛔ **The Team page rendered `userId` because it had nothing else**, and a `userId` is a Better Auth identifier — so a real founder's own row on their own team read `ITuMpGwp67CQWnjD4pYdttZDL6zID9H5`. The fixture had been putting an email address in that field, so every test and every browser walk showed something plausible and production showed an opaque string. ⚠️ **It is the invited address until somebody tells us otherwise**, which is the same value `Principal.name` carries for a human and is deliberately the same fact rather than a second one that can disagree. Never empty: an org's owner falls back to their own email.
  - `role` 'owner' | 'admin' | 'member', required
  - `createdAt` string, date-time, required

## Other responses

- `default`: An unexpected error response.

---

[API](https://skmtc.dev/foundermail/apis/org.md) - [All operations](https://skmtc.dev/foundermail/apis/org/llms.txt) - [OpenAPI document](https://skmtc.dev/foundermail/apis/org/revisions/8bbb36e378ab?raw)